Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/08/2024, 20:31

General

  • Target

    Wave.exe

  • Size

    33.4MB

  • MD5

    eaaf352176c3b1e0b40f0f57dca55450

  • SHA1

    9c70f9fd768ea4170fa1544176bca715d3492078

  • SHA256

    1fd3bb3104e2e2acdcf7568a42811804fc8d15e2213062072406ed084064cf7f

  • SHA512

    e6d7f8aaaa64316257c045a05fa4fb8a2a57e23fd94c2ff9f447d3f8c8a612ace8e00d6125963ae37e6ffb523baa8c2409ada852229eaaf789e5c93d3fb13d96

  • SSDEEP

    786432:19NB7vDydb3+KvIe6WCESWqE5SezZ8vqW8we8M8obiGc73rh0siKV:LNB7v2d9vIe6MqQZ19WbTIiGE0xM

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 49 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Wave.exe
    "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5524
    • C:\Users\Admin\AppData\Local\Temp\Wave.exe
      "C:\Users\Admin\AppData\Local\Temp\Wave.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5404
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic os get Caption
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2192
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5584
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4988
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Detects videocard installed
          PID:3884
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5864
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic computersystem get totalphysicalmemory
          4⤵
            PID:6008
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5848
          • C:\Windows\System32\wbem\WMIC.exe
            C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
            4⤵
              PID:2316
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1468
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic path softwarelicensingservice get OA3xOriginalProductKey
              4⤵
                PID:464
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3572
              • C:\Windows\System32\Wbem\WMIC.exe
                WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
                4⤵
                  PID:2020

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\VCRUNTIME140.dll

            Filesize

            116KB

            MD5

            be8dbe2dc77ebe7f88f910c61aec691a

            SHA1

            a19f08bb2b1c1de5bb61daf9f2304531321e0e40

            SHA256

            4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

            SHA512

            0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\VCRUNTIME140_1.dll

            Filesize

            48KB

            MD5

            f8dfa78045620cf8a732e67d1b1eb53d

            SHA1

            ff9a604d8c99405bfdbbf4295825d3fcbc792704

            SHA256

            a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5

            SHA512

            ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_asyncio.pyd

            Filesize

            37KB

            MD5

            6880e3d5872fefa9810753e181cf3033

            SHA1

            e875467792bbe3c4117040f6cf935a7a60a21d55

            SHA256

            c7000207e8c406f3a18b006649248906963834ff901c7b8b9f627d534e31575b

            SHA512

            f501bfe8300b20a621d587d9a86e1228ab90da5f4cab8ed47a2822617ca5eeaf66691756228745ff24084ba481f6b3eedcddfc4a4869cd56334e8ca53a92148d

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_bz2.pyd

            Filesize

            48KB

            MD5

            ab542da47a7745a2f588ca78d41734e0

            SHA1

            d8f1601548510333e35199e3b6bb4eaf994ca9ae

            SHA256

            4aba601dd528a85dad5975daf6aa394002c8a38582e4abb05a89684f52130084

            SHA512

            d80228ae846c562e08b08b92796e871e546760cd8ed92cbbe526675947ea2a5524ff4a93210e820c9f646912db24ff112ed2a354fc018a53a5161934c7fbd0f0

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_cffi_backend.cp312-win_amd64.pyd

            Filesize

            71KB

            MD5

            e8204fbeced1bbe02489cfee909d573e

            SHA1

            7625ee886d50ffa837db6e2ade9c74e86f0d4fa2

            SHA256

            d0aa34b160311a35ca2b888dbb9423e8990962b7c89655a5e9c1ba97324ace6b

            SHA512

            3638126cc76adb7c4aa23c2d62219dfe8a04cffb3dafac50adbd1f53fc603084f48b9240f10fcd92681bc7fb1f0a54159149e4c90f7ee8043a64c3a5c50bd05a

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_ctypes.pyd

            Filesize

            59KB

            MD5

            fc609234e81821c069d54a7c8d4a7e05

            SHA1

            9aef96aa0276feb2df28ce0abf4ec1f2f766d011

            SHA256

            506cdca8f4cc4754a78edac3be230a5ec7ca4a0d61ef08fe0accab4080b2c69e

            SHA512

            bea687c1a9ed32db6c99be1c8689ac9e498f0ffce74c0c66c6c7653d58b6ee90e50df66c8a48b49854d47142fa9a930047f4828651193f7a500ae7fbc1882d2e

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_decimal.pyd

            Filesize

            107KB

            MD5

            e3245ba10c125de02593c0a67669ab17

            SHA1

            6b846b98ee8f663aa39d3c6c960df8bc84d82193

            SHA256

            306cc1df8631d632e9831d6a710c8776784c4655b107424290338c385e743026

            SHA512

            26c4d7280a93dc004b0a92689c43b9bcb6c0afa282d24581051fd18d0037499c2c77431636ca20a9225af002f254526cf66ff466b3b7fad0d73b8096ce1594fc

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_hashlib.pyd

            Filesize

            35KB

            MD5

            fa6ae459e8a2c3071bd373da5a4cfe18

            SHA1

            dbf6462e952efe70f4ad72c0c8688456833462d5

            SHA256

            20af24170652420bc06adbb2fc159ae9e61e71f2cad5370b423c9ce4c57ad5e1

            SHA512

            9846f7fcf86fd67b03080a6ec270e4c6ecb0fee7bd0019fddd976c26e062c5d41f35691384a2307ca80289010f73cecf7326d7f446971639698b2948c4f67c08

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_lzma.pyd

            Filesize

            86KB

            MD5

            ed15089e3c0c1b2ab5b73354abf0087b

            SHA1

            f51ade203d249e27ebf9ae2159220fabdb8726c0

            SHA256

            02fe60ad99452d53294514e8c6b8d95d79cc013742e3a4cd74b36601fc3fb09b

            SHA512

            a9f869b2988057c37d14ee56495ecbf2ec688517203a7e2d1bc1488f4d37c6e3d3fb6fb439442c86679a9cebbbd5b2e7b11d42f64bdbce7212b6411cd27073ac

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_multiprocessing.pyd

            Filesize

            27KB

            MD5

            a2de86f88aad5c050f86d258b1f05617

            SHA1

            11824bbb09e5ee9865cadcbbfda1e0664c6d98ff

            SHA256

            f10fc80b19740eceb7fdce89c30d6670c9af7ed600fa7f881d27b8b5a054495f

            SHA512

            3662a8e6afa6b385a3e2682a49b0ae57f0f2aefc029eaaf841a228ec76c0f79c4e963b6f22eb345f4cad72b35bd72576a79a282d9816cf9b37b762773c10a80b

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_overlapped.pyd

            Filesize

            33KB

            MD5

            d2b3134bae2e401e1753aac8b9ca577e

            SHA1

            3b4c4fe61c724a6bc4ee423ee7a1efb007a1f515

            SHA256

            2386cf6ceaef4c6aa13974f913d6b3e6cde3b48e2fbb73f5c63ae6fe4384836f

            SHA512

            215609827121d9da6fa0bc884bd388391c46a799c22d54762775d591d9ae5e6bbce70011bc5f5237b6e526b79416c00f5daa8fc6baf70450ce37ced17fafa1f6

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_queue.pyd

            Filesize

            26KB

            MD5

            6cff25f6eb2872a07d52591cffe97ed7

            SHA1

            1e51fc338bcf4e868a827c8dd2d3573a60ec9a73

            SHA256

            b58694a5585645827ce1f0aa285e176e9328584917a36434132fd71c3f017d8d

            SHA512

            e847437f88dfd473272ed89f06fc9939c2e58e71f309275afa89599b4d79365459f763815660499be69b93b2440f3ed0dec88192d7d5b2be6ac2b79009a6442a

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_socket.pyd

            Filesize

            44KB

            MD5

            552d390e9c359bf460b87cfb9a24a48b

            SHA1

            d4920c3355b18087e9a392bea152cef90cc04a60

            SHA256

            f11b57f08a31e172cabae66830f9ef936e322a4df03ba5230d1621db4e7a24b6

            SHA512

            cfc59e43ab855f1c571db92c0df1258e88bc6db9d8569c2a5242b90d22f327503f4b4402f79f816f53f12a43f3d1ca84066231f0a3e719758340813f79528d8e

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_sqlite3.pyd

            Filesize

            57KB

            MD5

            435b49a7f84e7fbe0c6681932de37179

            SHA1

            a8a285579de10dacbfd053735c6f0ab930fe0fe2

            SHA256

            5321e5c26a9bcaebb58f11241121bd0d1e45f98dcfbb4d8457eae42f17b8328a

            SHA512

            13d7d7120a7a150d789b92964acbe6d2ea7ebb130d6cb1833456ea1cdd6654cdd1d8841165296b3f077935dbaec4a37ca7e45c395c0b72d9b6dc970dbb76136a

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_ssl.pyd

            Filesize

            66KB

            MD5

            318cfedf19856dbbc627e79ed9fd2b9c

            SHA1

            fb9b5565a033a8c6a4aee3f0a27de047714442d1

            SHA256

            efa7fef1f1456e19c44a787b62d047f5d73c6abb6a6d4201d125dc3d101fff09

            SHA512

            d5d616400fa33751bec6ce8786d4c29e6307f2042db0602907354734ff72387570201420290f5e99c375059ef7217159e254c44291b36f7f296574f506211e10

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_testcapi.pyd

            Filesize

            86KB

            MD5

            056fe629b0d09c81b2508fe020f573fb

            SHA1

            57650f99cf4989059a905e91a5b652691a16364c

            SHA256

            abfc2dff9dc4d881750e18406d7b72579c3198d19fba6a8b17e5b731dc3ebbf7

            SHA512

            a9ae6aa908a30b920b5ddd4187cdd016703cf44b0ed1b74cbe05cea32b4d8d74aa0489b1e30203f897c77a151189d28dbe751f6abc06211e1f7eb50ee946788f

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_testinternalcapi.pyd

            Filesize

            31KB

            MD5

            8d093aa8b56a712c85c111c3e8499c03

            SHA1

            961e3703f3ce97228b89f3119e03fb604b9adb50

            SHA256

            9df34b9f9e658dfc882d1c69bed57ca47660eb4f09066ba83ec92f3c1fee2ddd

            SHA512

            d01512df46861d6ae1b8af3a1fe1c20cf2323aaeb22d9f79510db85dcace0487241df2e92e1b75c69c8459cebbc62d13a0306982298333138f4ae618598e499b

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_tkinter.pyd

            Filesize

            38KB

            MD5

            66fa43762fbf1a3051a4517eae9966fc

            SHA1

            836473cd01e92cb9085c373a0efe148267488f3c

            SHA256

            2263317a838f36d4eac8c580abcb65232902940f31e86257453f3a720722e2e9

            SHA512

            955495faa4366104a63d72be201a0f0d8c0ea2e0d192a1cde2f2cf158f1652db3f089f8bae62a594dd794bda4ce6a3f61bdaf3c2f124c4439276e688b7217c89

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_uuid.pyd

            Filesize

            25KB

            MD5

            50521b577719195d7618a23b3103d8aa

            SHA1

            7020d2e107000eaf0eddde74bc3809df2c638e22

            SHA256

            acbf831004fb8b8d5340fe5debd9814c49bd282dd765c78faeb6bb5116288c78

            SHA512

            4ee950da8bbbd36932b488ec62fa046ac8fc35783a146edadbe063b8419a63d4dfb5bbd8c45e9e008fe708e6fc4a1fee1202fce92ffc95320547ba714fed95e1

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\_wmi.pyd

            Filesize

            28KB

            MD5

            54ba74f0c557b0c0463c08b5d2439379

            SHA1

            8aa3f3f50501962f4a64ead15b24b6a77b06c5c5

            SHA256

            53d4c23bc2ba89ee5050bae9b498eebbcde5a1906e51389742780f0c976b861f

            SHA512

            fa4b6ca32a635f3a17d1e50b2b0a0c9e184cc104c2632b1d57c2a14db30272e6985a5665c567f49a5d4a6f36bfe80db9b5c591856d1667c024631a7050efb5fe

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\base_library.zip

            Filesize

            1.3MB

            MD5

            1736b196dda9607e73f615ecaddfd30a

            SHA1

            d84394a9970ce620c2b6a0fc5ddb46f82856767a

            SHA256

            1884d4eba71e943d4936c6d7a301c43a1e236cad2c5fef65e9cc0f065c843658

            SHA512

            3ceec0fecbb315139ad7970b466289e55360e78c965231a86db7d0b4e9f06e023668f51c70608964d7e06e48352e3e4c53a203f328a817306a538428912fb6f8

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\certifi\cacert.pem

            Filesize

            284KB

            MD5

            181ac9a809b1a8f1bc39c1c5c777cf2a

            SHA1

            9341e715cea2e6207329e7034365749fca1f37dc

            SHA256

            488ba960602bf07cc63f4ef7aec108692fec41820fc3328a8e3f3de038149aee

            SHA512

            e19a92b94aedcf1282b3ef561bd471ea19ed361334092c55d72425f9183ebd1d30a619e493841b6f75c629f26f28dc682960977941b486c59475f21cf86fff85

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\charset_normalizer\md.cp312-win_amd64.pyd

            Filesize

            9KB

            MD5

            e4fad9ff1b85862a6afaca2495d9f019

            SHA1

            0e47d7c5d4de3a1d7e3bb31bd47ea22cc4ddeac4

            SHA256

            e5d362766e9806e7e64709de7e0cff40e03123d821c3f30cac5bac1360e08c18

            SHA512

            706fb033fc2079b0aabe969bc51ccb6ffaaf1863daf0e4a83d6f13adc0fedab61cee2b63efb40f033aea22bf96886834d36f50af36e6e25b455e941c1676a30a

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\charset_normalizer\md__mypyc.cp312-win_amd64.pyd

            Filesize

            39KB

            MD5

            5c643741418d74c743ca128ff3f50646

            SHA1

            0b499a3228865a985d86c1199d14614096efd8a0

            SHA256

            2d86563fdfdc39894a53a293810744915192f3b3f40a47526551e66cdb9cb35c

            SHA512

            45d02b854557d8f9c25ca8136fa6d3daed24275cc77b1c98038752daed4318bd081c889ff1f4fa8a28e734c9167f477350a8fa863f61729c30c76e7a91d61a97

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\jaraco\text\Lorem ipsum.txt

            Filesize

            1KB

            MD5

            4ce7501f6608f6ce4011d627979e1ae4

            SHA1

            78363672264d9cd3f72d5c1d3665e1657b1a5071

            SHA256

            37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b

            SHA512

            a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\libcrypto-3.dll

            Filesize

            1.6MB

            MD5

            63eb76eccfe70cff3a3935c0f7e8ba0f

            SHA1

            a8dd05dce28b79047e18633aee5f7e68b2f89a36

            SHA256

            785c8dde9803f8e1b279895c4e598a57dc7b01e0b1a914764fcedef0d7928b4e

            SHA512

            8da31fa77ead8711c0c6ffedcef6314f29d02a95411c6aacec626e150f329a5b96e9fdeae8d1a5e24d1ca5384ae2f0939a5cc0d58eb8bdbc5f00e62736dcc322

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\libffi-8.dll

            Filesize

            29KB

            MD5

            be8ceb4f7cb0782322f0eb52bc217797

            SHA1

            280a7cc8d297697f7f818e4274a7edd3b53f1e4d

            SHA256

            7d08df2c496c32281bf9a010b62e8898b9743db8b95a7ebee12d746c2e95d676

            SHA512

            07318c71c3137114e0cfec7d8b4815fd6efa51ce70b377121f26dc469cefe041d5098e1c92af8ed0c53b21e9c845fddee4d6646d5bd8395a3f1370ba56a59571

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\libssl-3.dll

            Filesize

            222KB

            MD5

            7e87c34b39f3a8c332df6e15fd83160b

            SHA1

            db712b55f23d8e946c2d91cbbeb7c9a78a92b484

            SHA256

            41448b8365b3a75cf33894844496eb03f84e5422b72b90bdcb9866051939c601

            SHA512

            eceda8b66736edf7f8e7e6d5a17e280342e989c5195525c697cc02dda80fd82d62c7fd4dc6c4825425bae69a820e1262b8d8cc00dbcd73868a26e16c14ac5559

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\luna.aes

            Filesize

            34KB

            MD5

            00aba64f0951ed09055d5c06f0e00b43

            SHA1

            06042bc2a9e06f05eb7d7cc37b954c5c52ac0cfa

            SHA256

            0a19ef39c0e98655129659a7764284f01ef4781544e6a944c406a342e8ac93fa

            SHA512

            7210c237e6d1b0b4d079dae1ce775b6408b694fa6b7bd5faeb1eef5c243229f7c375f1082b284784959ccac615353e240d22dc5412d340f08fd9ef5934c44e9f

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\pyexpat.pyd

            Filesize

            88KB

            MD5

            7291100352b163626455abf2252f2a96

            SHA1

            3c4d13bbf5fb69fe6f2af70f675ed2e437cea893

            SHA256

            01974148486d569e9f1ad62d36d4d54b5396b07c853bd50f358d5580fde331f4

            SHA512

            fc384703828bb7a38b51dcf1a131b49283808b5658395e1d1c5ee9a204f895da0c29b12a7b1fc9aa468babc5d6f03be638fecf519e41911bf015a481f95458bc

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\python3.DLL

            Filesize

            66KB

            MD5

            a07661c5fad97379cf6d00332999d22c

            SHA1

            dca65816a049b3cce5c4354c3819fef54c6299b0

            SHA256

            5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b

            SHA512

            6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\python312.dll

            Filesize

            1.7MB

            MD5

            8f165bfadf970edafd59067ad45a3952

            SHA1

            16c1876f2233087156b49db35d4d935c6e17be6a

            SHA256

            22470af77229d53d9141823c12780db63c43703dd525940bc479730d2e43513d

            SHA512

            b3af95dc9a68e21e8eca98e451b935f72663c2552ebf26de299716f17193f238d55c292df953d641defcbcec3ea18eb37cd4b839800804efa8f40658427263ae

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\select.pyd

            Filesize

            25KB

            MD5

            3b214dfb6ec4ca67be55b3aa52922827

            SHA1

            f665ffeab25d2bab506b873be944280586eb50f6

            SHA256

            7507a92c4787e9e7936a0b4a8eeb0a3f24e5ee12ae58cd7988543581d99817ac

            SHA512

            de4e9b9d79b01d21aca74179c6a3e8fc6fe041f71cdd78910fd893cda90c2cfe7e54ade91064333f37ffc880d446879a64dd8bb790677039df56df1f80ec6b45

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\sqlite3.dll

            Filesize

            644KB

            MD5

            b26fa7619d82c7272b7279eb7aae801c

            SHA1

            fa6a3240a531615a0853306f3b3d66aed98a04d8

            SHA256

            74dc76a2a2d06d61f9f06bd3b0972bfb30ab57b0e5cb8c3011e79ce4a52924f0

            SHA512

            20b0d6cf3e07ca0d565f140c9f9c1e218406ed9bdaaf75433858acb250bfb71bb134a6479fdcf6d4d0e0252707b1fb14f9c9d3e4d6a40824c3fdc7a43dfad0ee

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\tcl86t.dll

            Filesize

            652KB

            MD5

            f31b4bd4866929ef7bc212782583aef5

            SHA1

            d5060178cdc4c8aa6dd85ab26448ba8bf76f7079

            SHA256

            299f1ef2362fde11b413a35d99a4a7bc046923e5dd601f5ae514d57dfd73d954

            SHA512

            716c6d913cc8a3b3965cba2b70237a99073cbb372767e05c32af5dbf6dfc6379267815954e20d15ccbec79ffeb68c1f66f703196195bc1456374703626aa7ac0

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\tk86t.dll

            Filesize

            626KB

            MD5

            1e04190c21fbc017f6a76974b55821db

            SHA1

            f1db74c8e92fda7c9ec1db88f20c23a86b737617

            SHA256

            eb02c02d7ede94b11480557f41d85d48e6a8fe409bd9aac477d7597b4ee2eddc

            SHA512

            63c34dd51b73ae6d8a349adc32709e1de704aa64c4e16f06be68d4ad829a62b13269739f0e5d0f797e88fb9daddeaa62efc1e5ce33e6ed4e473593ab4824efc2

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\typeguard-4.3.0.dist-info\INSTALLER

            Filesize

            4B

            MD5

            365c9bfeb7d89244f2ce01c1de44cb85

            SHA1

            d7a03141d5d6b1e88b6b59ef08b6681df212c599

            SHA256

            ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

            SHA512

            d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\unicodedata.pyd

            Filesize

            295KB

            MD5

            97f08bbcf9903c768668b1cd1e30aada

            SHA1

            84e2dc5c3662bd39ac09b5f682a59104ffec16d2

            SHA256

            c5c2997c3b16eb8b89fe230582a579a753efc8317ffd95d9795ec2762aa54ed9

            SHA512

            076ca0017ae252d62d4a3bd7a42af95800e39a164bda990a0ca651aa2f0df2736c0dfdc086d8328a1834ae89f17716c5f76e798460a90263d1d8b6f2c233c686

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\zlib1.dll

            Filesize

            77KB

            MD5

            7250d6ff20cc06b115e965662a18e94f

            SHA1

            adc6902b75492a06ad4b1b24627f4dfe2ee3b9b2

            SHA256

            91daca770fc15bca5a9e4c8fc04c2a81953f9fc35c741fe68ef27817e2be9579

            SHA512

            cf87c842e876da92deace197f94bc93292862650dff7e4ae6fb6411e39f9aa938b8ba9a4a7ad7f5f5094dae1c395cfd4f132bdf8481117eef09b8f83cc3f33a9

          • C:\Users\Admin\AppData\Local\Temp\_MEI55242\zstandard\backend_c.cp312-win_amd64.pyd

            Filesize

            167KB

            MD5

            2f12da584a362bad45c6b9b3ddd2445c

            SHA1

            86adc05435a9a7dc0b0c676456b15f64d7df6f44

            SHA256

            da95d86762fb4ea6a479990e1b91591ccad7d0f88072a7805052cd71168db115

            SHA512

            6113292936ea39c45764c240e04a92479403ef6c64aa959922e94f990f8d405299793acbdeb8a4c924d81857e12b3d83e7c8c93c261e8101f4eee44ab77dc92e

          • memory/1532-1747-0x00007FF8982D0000-0x00007FF89844F000-memory.dmp

            Filesize

            1.5MB

          • memory/1532-1754-0x00007FF899960000-0x00007FF89996B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1713-0x00007FF8A8F80000-0x00007FF8A8F8D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1712-0x00007FF8A8CF0000-0x00007FF8A8D09000-memory.dmp

            Filesize

            100KB

          • memory/1532-1715-0x00007FF8A8E10000-0x00007FF8A8E1D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1717-0x00007FF8A8CD0000-0x00007FF8A8CE4000-memory.dmp

            Filesize

            80KB

          • memory/1532-1719-0x00007FF898770000-0x00007FF898C99000-memory.dmp

            Filesize

            5.2MB

          • memory/1532-1723-0x00007FF899A50000-0x00007FF899B1D000-memory.dmp

            Filesize

            820KB

          • memory/1532-1722-0x00007FF8A8C90000-0x00007FF8A8CC3000-memory.dmp

            Filesize

            204KB

          • memory/1532-1702-0x00007FF8AC9F0000-0x00007FF8AC9FF000-memory.dmp

            Filesize

            60KB

          • memory/1532-1726-0x00007FF8A8A90000-0x00007FF8A8AA6000-memory.dmp

            Filesize

            88KB

          • memory/1532-1728-0x00007FF8A4DC0000-0x00007FF8A4DD2000-memory.dmp

            Filesize

            72KB

          • memory/1532-1703-0x00007FF8A8FD0000-0x00007FF8A8FEA000-memory.dmp

            Filesize

            104KB

          • memory/1532-1732-0x00007FF8999C0000-0x00007FF899A47000-memory.dmp

            Filesize

            540KB

          • memory/1532-1731-0x00007FF898CA0000-0x00007FF899364000-memory.dmp

            Filesize

            6.8MB

          • memory/1532-1704-0x00007FF8A8FA0000-0x00007FF8A8FCD000-memory.dmp

            Filesize

            180KB

          • memory/1532-1708-0x00007FF8AC700000-0x00007FF8AC70F000-memory.dmp

            Filesize

            60KB

          • memory/1532-1738-0x00007FF89A290000-0x00007FF89A2B7000-memory.dmp

            Filesize

            156KB

          • memory/1532-1737-0x00007FF8A8320000-0x00007FF8A832B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1742-0x00007FF898450000-0x00007FF89856B000-memory.dmp

            Filesize

            1.1MB

          • memory/1532-1709-0x00007FF8A8D10000-0x00007FF8A8D46000-memory.dmp

            Filesize

            216KB

          • memory/1532-1740-0x00007FF8AC700000-0x00007FF8AC70F000-memory.dmp

            Filesize

            60KB

          • memory/1532-1745-0x00007FF899990000-0x00007FF8999B4000-memory.dmp

            Filesize

            144KB

          • memory/1532-1744-0x00007FF89FE60000-0x00007FF89FE78000-memory.dmp

            Filesize

            96KB

          • memory/1532-1746-0x00007FF8A8E10000-0x00007FF8A8E1D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1750-0x00007FF8A4DB0000-0x00007FF8A4DBB000-memory.dmp

            Filesize

            44KB

          • memory/1532-1749-0x00007FF8A8CD0000-0x00007FF8A8CE4000-memory.dmp

            Filesize

            80KB

          • memory/1532-1748-0x00007FF89A270000-0x00007FF89A28C000-memory.dmp

            Filesize

            112KB

          • memory/1532-1662-0x00007FF898CA0000-0x00007FF899364000-memory.dmp

            Filesize

            6.8MB

          • memory/1532-1767-0x00007FF898260000-0x00007FF89826C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1766-0x00007FF898270000-0x00007FF89827C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1765-0x00007FF899A50000-0x00007FF899B1D000-memory.dmp

            Filesize

            820KB

          • memory/1532-1772-0x00007FF8981F0000-0x00007FF898219000-memory.dmp

            Filesize

            164KB

          • memory/1532-1771-0x00007FF898230000-0x00007FF898242000-memory.dmp

            Filesize

            72KB

          • memory/1532-1770-0x00007FF8981C0000-0x00007FF8981EE000-memory.dmp

            Filesize

            184KB

          • memory/1532-1769-0x00007FF898220000-0x00007FF89822C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1768-0x00007FF898250000-0x00007FF89825D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1764-0x00007FF8A8C90000-0x00007FF8A8CC3000-memory.dmp

            Filesize

            204KB

          • memory/1532-1763-0x00007FF899980000-0x00007FF89998B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1762-0x00007FF898280000-0x00007FF89828B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1761-0x00007FF898290000-0x00007FF89829B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1760-0x00007FF8982A0000-0x00007FF8982AC000-memory.dmp

            Filesize

            48KB

          • memory/1532-1759-0x00007FF8982B0000-0x00007FF8982BE000-memory.dmp

            Filesize

            56KB

          • memory/1532-1758-0x00007FF8982C0000-0x00007FF8982CC000-memory.dmp

            Filesize

            48KB

          • memory/1532-1757-0x00007FF899930000-0x00007FF89993C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1756-0x00007FF899940000-0x00007FF89994B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1755-0x00007FF899950000-0x00007FF89995C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1701-0x00007FF8A9040000-0x00007FF8A9065000-memory.dmp

            Filesize

            148KB

          • memory/1532-1753-0x00007FF899970000-0x00007FF89997C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1752-0x00007FF8A4DA0000-0x00007FF8A4DAB000-memory.dmp

            Filesize

            44KB

          • memory/1532-1751-0x00007FF898770000-0x00007FF898C99000-memory.dmp

            Filesize

            5.2MB

          • memory/1532-1774-0x00007FF8A4DC0000-0x00007FF8A4DD2000-memory.dmp

            Filesize

            72KB

          • memory/1532-1801-0x00007FF89FE60000-0x00007FF89FE78000-memory.dmp

            Filesize

            96KB

          • memory/1532-1795-0x00007FF8A8A90000-0x00007FF8A8AA6000-memory.dmp

            Filesize

            88KB

          • memory/1532-1793-0x00007FF8A8C90000-0x00007FF8A8CC3000-memory.dmp

            Filesize

            204KB

          • memory/1532-1788-0x00007FF8A8CF0000-0x00007FF8A8D09000-memory.dmp

            Filesize

            100KB

          • memory/1532-1786-0x00007FF8AC700000-0x00007FF8AC70F000-memory.dmp

            Filesize

            60KB

          • memory/1532-1785-0x00007FF8A8FA0000-0x00007FF8A8FCD000-memory.dmp

            Filesize

            180KB

          • memory/1532-1784-0x00007FF8A8FD0000-0x00007FF8A8FEA000-memory.dmp

            Filesize

            104KB

          • memory/1532-1783-0x00007FF8AC9F0000-0x00007FF8AC9FF000-memory.dmp

            Filesize

            60KB

          • memory/1532-1802-0x00007FF899990000-0x00007FF8999B4000-memory.dmp

            Filesize

            144KB

          • memory/1532-1809-0x00007FF899960000-0x00007FF89996B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1828-0x00007FF8981F0000-0x00007FF898219000-memory.dmp

            Filesize

            164KB

          • memory/1532-1832-0x00007FF898250000-0x00007FF89825D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1831-0x00007FF8981C0000-0x00007FF8981EE000-memory.dmp

            Filesize

            184KB

          • memory/1532-1830-0x00007FF898220000-0x00007FF89822C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1829-0x00007FF898280000-0x00007FF89828B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1827-0x00007FF898290000-0x00007FF89829B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1826-0x00007FF8982A0000-0x00007FF8982AC000-memory.dmp

            Filesize

            48KB

          • memory/1532-1825-0x00007FF8982B0000-0x00007FF8982BE000-memory.dmp

            Filesize

            56KB

          • memory/1532-1824-0x00007FF8982C0000-0x00007FF8982CC000-memory.dmp

            Filesize

            48KB

          • memory/1532-1823-0x00007FF899930000-0x00007FF89993C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1822-0x00007FF899940000-0x00007FF89994B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1821-0x00007FF899950000-0x00007FF89995C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1820-0x00007FF898260000-0x00007FF89826C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1819-0x00007FF899970000-0x00007FF89997C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1818-0x00007FF8A4DA0000-0x00007FF8A4DAB000-memory.dmp

            Filesize

            44KB

          • memory/1532-1817-0x00007FF8982D0000-0x00007FF89844F000-memory.dmp

            Filesize

            1.5MB

          • memory/1532-1816-0x00007FF89A270000-0x00007FF89A28C000-memory.dmp

            Filesize

            112KB

          • memory/1532-1815-0x00007FF8A4DB0000-0x00007FF8A4DBB000-memory.dmp

            Filesize

            44KB

          • memory/1532-1814-0x00007FF898270000-0x00007FF89827C000-memory.dmp

            Filesize

            48KB

          • memory/1532-1813-0x00007FF898230000-0x00007FF898242000-memory.dmp

            Filesize

            72KB

          • memory/1532-1812-0x00007FF899980000-0x00007FF89998B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1800-0x00007FF898450000-0x00007FF89856B000-memory.dmp

            Filesize

            1.1MB

          • memory/1532-1799-0x00007FF89A290000-0x00007FF89A2B7000-memory.dmp

            Filesize

            156KB

          • memory/1532-1798-0x00007FF8A8320000-0x00007FF8A832B000-memory.dmp

            Filesize

            44KB

          • memory/1532-1797-0x00007FF8999C0000-0x00007FF899A47000-memory.dmp

            Filesize

            540KB

          • memory/1532-1796-0x00007FF8A4DC0000-0x00007FF8A4DD2000-memory.dmp

            Filesize

            72KB

          • memory/1532-1794-0x00007FF899A50000-0x00007FF899B1D000-memory.dmp

            Filesize

            820KB

          • memory/1532-1792-0x00007FF898770000-0x00007FF898C99000-memory.dmp

            Filesize

            5.2MB

          • memory/1532-1791-0x00007FF8A8CD0000-0x00007FF8A8CE4000-memory.dmp

            Filesize

            80KB

          • memory/1532-1790-0x00007FF8A8E10000-0x00007FF8A8E1D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1789-0x00007FF8A8F80000-0x00007FF8A8F8D000-memory.dmp

            Filesize

            52KB

          • memory/1532-1787-0x00007FF8A8D10000-0x00007FF8A8D46000-memory.dmp

            Filesize

            216KB

          • memory/1532-1781-0x00007FF898CA0000-0x00007FF899364000-memory.dmp

            Filesize

            6.8MB

          • memory/1532-1782-0x00007FF8A9040000-0x00007FF8A9065000-memory.dmp

            Filesize

            148KB